114.235.205.92.host.secureserver.net Open in urlscan Pro
92.205.235.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Submission Tags: @phish_report
Submission: On December 19 via api (December 19th 2024, 5:24:10 pm UTC) from FI — Scanned from FI

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 12 domains to perform 26 HTTP transactions. The main IP is 92.205.235.114, located in Germany and belongs to GODADDY-SXB Host Europe GmbH, DE. The main domain is 114.235.205.92.host.secureserver.net.
TLS certificate: Issued by R10 on December 9th 2024. Valid for: 3 months.

This is the only time 114.235.205.92.host.secureserver.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Universo Online (UOL) (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	92.205.235.114 92.205.235.114	21499 (GODADDY-S...) (GODADDY-SXB Host Europe GmbH)
2	104.18.37.248 104.18.37.248	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.201.242.112 23.201.242.112	16625 (AKAMAI-AS) (AKAMAI-AS)
1	200.147.99.186 200.147.99.186	7162 (Universo ...) (Universo Online S.A.)
1	186.234.166.8 186.234.166.8	7162 (Universo ...) (Universo Online S.A.)
2	18.172.112.71 18.172.112.71	16509 (AMAZON-02) (AMAZON-02)
1	172.64.153.151 172.64.153.151	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.99.79 13.32.99.79	16509 (AMAZON-02) (AMAZON-02)
1	52.222.214.58 52.222.214.58	16509 (AMAZON-02) (AMAZON-02)
2	13.35.58.117 13.35.58.117	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.40 142.250.186.40	15169 (GOOGLE) (GOOGLE)
1 3	18.244.18.32 18.244.18.32	16509 (AMAZON-02) (AMAZON-02)
1	185.89.210.82 185.89.210.82	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	34.102.185.99 34.102.185.99	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	216.239.32.36 216.239.32.36	15169 (GOOGLE) (GOOGLE)
1	142.251.173.155 142.251.173.155	15169 (GOOGLE) (GOOGLE)
1	142.250.184.227 142.250.184.227	15169 (GOOGLE) (GOOGLE)
26	18

2 92.205.235.114 (Germany)

ASN21499 (GODADDY-SXB Host Europe GmbH, DE)
PTR: 114.235.205.92.host.secureserver.net

114.235.205.92.host.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.37.248 (None, )

ASN13335 (CLOUDFLARENET, US)

dna-checker.pagseguro.uol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.201.242.112 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-201-242-112.deploy.static.akamaitechnologies.com

cdn-4.convertexperiments.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 200.147.99.186 (Brazil)

ASN7162 (Universo Online S.A., BR)
PTR: 200-147-99-186.static.uol.com.br

tracker.bt.uol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 186.234.166.8 (Brazil)

ASN7162 (Universo Online S.A., BR)

imguol.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.172.112.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-172-112-71.fra60.r.cloudfront.net

tm.jsuol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.153.151 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

dna.uol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-79.fra60.r.cloudfront.net

tm.uol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-58.fra56.r.cloudfront.net

me.jsuol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.58.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-117.fra60.r.cloudfront.net

udr.uol.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.40 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.244.18.32 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-32.fra56.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.82 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.102.185.99 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 99.185.102.34.bc.googleusercontent.com

m.t.tailtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.32.36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.173.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wi-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f3.1e100.net

www.google.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	uol.com.br dna-checker.pagseguro.uol.com.br — Cisco Umbrella Rank: 576416 tracker.bt.uol.com.br — Cisco Umbrella Rank: 93962 dna.uol.com.br — Cisco Umbrella Rank: 471755 tm.uol.com.br — Cisco Umbrella Rank: 88807 udr.uol.com.br — Cisco Umbrella Rank: 110943	49 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 186	7 KB
3	jsuol.com.br jsuol.com.br Failed tm.jsuol.com.br — Cisco Umbrella Rank: 83366 me.jsuol.com.br — Cisco Umbrella Rank: 112165	29 KB
2	tailtarget.com 1 redirects m.t.tailtarget.com — Cisco Umbrella Rank: 213136	751 B
2	secureserver.net 114.235.205.92.host.secureserver.net	3 KB
1	google.fi www.google.fi — Cisco Umbrella Rank: 41557	408 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	559 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4108
1	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 281	587 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	95 KB
1	imguol.com imguol.com — Cisco Umbrella Rank: 128990	5 KB
1	convertexperiments.com cdn-4.convertexperiments.com — Cisco Umbrella Rank: 8759	77 KB
26	12

	Domain	Requested by
3	sb.scorecardresearch.com	1 redirects 114.235.205.92.host.secureserver.net
2	m.t.tailtarget.com	1 redirects 114.235.205.92.host.secureserver.net
2	udr.uol.com.br	tm.jsuol.com.br
2	tm.jsuol.com.br	114.235.205.92.host.secureserver.net tm.jsuol.com.br
2	dna-checker.pagseguro.uol.com.br	114.235.205.92.host.secureserver.net
2	114.235.205.92.host.secureserver.net	114.235.205.92.host.secureserver.net
1	www.google.fi	114.235.205.92.host.secureserver.net
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	ib.adnxs.com	tm.jsuol.com.br
1	www.googletagmanager.com	me.jsuol.com.br
1	me.jsuol.com.br	tm.jsuol.com.br
1	tm.uol.com.br	tm.jsuol.com.br 114.235.205.92.host.secureserver.net
1	dna.uol.com.br	114.235.205.92.host.secureserver.net
1	imguol.com	114.235.205.92.host.secureserver.net
1	tracker.bt.uol.com.br	114.235.205.92.host.secureserver.net
1	cdn-4.convertexperiments.com	114.235.205.92.host.secureserver.net
0	jsuol.com.br Failed	114.235.205.92.host.secureserver.net
26	18

This site contains no links.

Subject Issuer	Validity	Valid
114.235.205.92.host.secureserver.net R10	`2024-12-09` - `2025-03-09`	3 months	crt.sh
pagseguro.uol.com.br WE1	`2024-11-22` - `2025-02-20`	3 months	crt.sh
*.convertexperiments.com DigiCert TLS RSA SHA256 2020 CA1	`2024-09-11` - `2025-09-10`	a year	crt.sh
uol.com GeoTrust TLS RSA CA G1	`2024-08-23` - `2025-09-22`	a year	crt.sh
*.imguol.com RapidSSL TLS RSA CA G1	`2024-07-22` - `2025-08-06`	a year	crt.sh
*.jsuol.com.br Amazon RSA 2048 M03	`2024-07-03` - `2025-07-31`	a year	crt.sh
dna.uol.com.br WE1	`2024-12-08` - `2025-03-08`	3 months	crt.sh
*.uol.com.br Amazon RSA 2048 M02	`2024-06-05` - `2025-07-04`	a year	crt.sh
*.google-analytics.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
*.scorecardresearch.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-15` - `2025-02-14`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh
*.google.fi WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Frame ID: 59D1B94982BB67BBB86EC171E3F62AE0
Requests: 23 HTTP requests in this frame

Frame: https://tm.uol.com.br/mercurio.html
Frame ID: C634DDF785351D2755D61C3E2F8885BC
Requests: 1 HTTP requests in this frame

Frame: https://tm.uol.com.br/purge-clients.html?name=DEretargeting&expname=DEretargetingExp&expdomain=1
Frame ID: CA50FADF7CF6F539FD3717BF7794CE07
Requests: 1 HTTP requests in this frame

Frame: https://tm.uol.com.br/purge-clients.html?name=dynad_rt&expname=dynad_rt_exp&expdomain=1
Frame ID: 8FC22449AD8DE3210B53BF4E7D879713
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

E-mail UOL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

26
Requests

77 %
HTTPS

0 %
IPv6

12
Domains

18
Subdomains

18
IPs

4
Countries

267 kB
Transfer

829 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://sb.scorecardresearch.com/cs/6036356/beacon.js HTTP 302
https://sb.scorecardresearch.com/internal-cs/6036356/beacon-ios.js

Request Chain 17

https://m.t.tailtarget.com/sync/TT-10162-1/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP 302
https://m.t.tailtarget.com/sync/TT-10162-1/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?check=1

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/ 6 KB
3 KB 533ms
183ms Document
text/html 92.205.235.114
GODADDY-SXB Host ...

General

Check archive.org

Show headers Download Go to

Full URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 92.205.235.114 , Germany, ASN21499 (GODADDY-SXB Host Europe GmbH, DE),
Reverse DNS: 114.235.205.92.host.secureserver.net
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3a2c1203bb0b89977e59c0ec25bc379a0c8bad578ee295bea37f1d529234362e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 2355
Content-Type: text/html; charset=UTF-8
Date: Thu, 19 Dec 2024 17:24:01 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 404
Not Found main.59a0a285.chunk.css
114.235.205.92.host.secureserver.net/ProdutosUol/acesso/index_files/ 0
0 215ms
213ms Stylesheet
text/html 92.205.235.114
GODADDY-SXB Host ...

General

Check archive.org

Show headers Download Go to

Full URL: https://114.235.205.92.host.secureserver.net/ProdutosUol/acesso/index_files/main.59a0a285.chunk.css
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 92.205.235.114 , Germany, ASN21499 (GODADDY-SXB Host Europe GmbH, DE),
Reverse DNS: 114.235.205.92.host.secureserver.net
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/

Response headers

Keep-Alive: timeout=5, max=99
Content-Length: 299
Date: Thu, 19 Dec 2024 17:24:01 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Apache/2.4.41 (Ubuntu)
Connection: Keep-Alive

GET jquery.min.js
jsuol.com.br/px/ 0
0

GET
H2 200 bhr.js Show response
dna-checker.pagseguro.uol.com.br/ 29 B
507 B 1801ms
594ms Script
application/javascript 104.18.37.248
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dna-checker.pagseguro.uol.com.br/bhr.js?v=0.1.89

Requested by

Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.248 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e787af995b842a676901ade5af3d5b2ef18a1e6b0dd4000dfc50bd0adcc3f6d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
cf-cache-status: DYNAMIC
etag: W/"1d-193d0738178"
x-content-type-options: nosniff
cf-ray: 8f4915857de64e0f-HEL
x-response-time: 1.031ms
accept-ranges: bytes
content-length: 29
date: Thu, 19 Dec 2024 17:24:04 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 16 Dec 2024 17:10:51 GMT
server: cloudflare

GET
H2 200 10045931-10046043.js Show response
cdn-4.convertexperiments.com/js/ 271 KB
77 KB 862ms
315ms Script
application/javascript 23.201.242.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-4.convertexperiments.com/js/10045931-10046043.js
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.242.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-242-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5918ec0b37addadbc1c75720dcad660a82f95f4e21ed4e2593d56945f714100b

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

access-control-max-age: 86400
cache-control: public, max-age=300
content-encoding: gzip
access-control-allow-methods: GET,HEAD,POST,OPTIONS
expires: Thu, 19 Dec 2024 17:29:02 GMT
access-control-allow-origin: *
date: Thu, 19 Dec 2024 17:24:02 GMT
content-type: application/javascript
vary: Accept-Encoding
access-control-allow-headers: *

GET
H/1.1 200
OK partner Show response
tracker.bt.uol.com.br/ 0
546 B 1480ms
542ms Script
application/javascript 200.147.99.186
Universo Online S.A.

General

Check archive.org

Show headers Download Go to

Full URL: https://tracker.bt.uol.com.br/partner?source=tagmanager
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 200.147.99.186 , Brazil, ASN7162 (Universo Online S.A., BR),
Reverse DNS: 200-147-99-186.static.uol.com.br
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Connection: close
Expires: Thu, 19 Dec 2024 17:24:01 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID TAIa OUR IND COM NAV INT CNT"
Date: Thu, 19 Dec 2024 17:24:02 GMT
Content-Type: application/javascript;charset=utf-8
Server: nginx

GET
H2 200 logo_uolmail2.png
imguol.com/p/g/logos/ 5 KB
5 KB 2952ms
607ms Image
image/png 186.234.166.8
Universo Online S.A.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imguol.com/p/g/logos/logo_uolmail2.png
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 186.234.166.8 , Brazil, ASN7162 (Universo Online S.A., BR),
Reverse DNS
Software: nginx /
Resource Hash: b75d97768deedde2829838149f82856789465d957771f78e54644a876626d262

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: max-age=86400
etag: "8b870a78dd6243d8cd57b8a7aa18351d"
age: 191071
expires: Tue, 24 Dec 2024 12:19:32 GMT
accept-ranges: bytes
x-cache: HIT
content-length: 5247
date: Thu, 19 Dec 2024 17:24:04 GMT
content-type: image/png
last-modified: Wed, 28 Apr 2021 14:47:08 GMT
server: nginx

GET
H2 200 uoltm.js Show response
tm.jsuol.com.br/ 74 KB
18 KB 1117ms
405ms Script
application/javascript 18.172.112.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tm.jsuol.com.br/uoltm.js?id=ouy6ez
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.112.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-172-112-71.fra60.r.cloudfront.net
Software: marrakesh 1.23.0 /
Resource Hash: 8215eb90b2ba2320f0374d7f10190377d5b1d5b65d3077b7fec0f1fa75200dc0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-transform, max-age=3600, must-revalidate, proxy-revalidate, must-revalidate, proxy-revalidate, no-transform
content-encoding: gzip
etag: 704701f43e30c983703562bbed1830c9
via: 1.1 67697a0060e2336f6ffa8579d528820e.cloudfront.net (CloudFront)
expires: Thu, 19 Dec 2024 18:24:03 GMT
x-cache: Miss from cloudfront
content-length: 17412
x-amz-cf-id: xeMYC65SDWfFVq6LgCjZ0gE1z5QFW3k3P5T-HS7Qp5iOMsccj7mgOQ==
date: Thu, 19 Dec 2024 17:24:03 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Fri, 30 Aug 2024 19:06:48 GMT
server: marrakesh 1.23.0
x-amz-cf-pop: FRA60-P8
vary: Accept-Encoding

GET
H2 200 dna.min.js Show response
dna.uol.com.br/js/ 157 KB
47 KB 1468ms
677ms Script
application/javascript 172.64.153.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dna.uol.com.br/js/dna.min.js

Requested by

Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.153.151 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecbd019f0900cc8cdd11f7f7953ec3f4a6afc68d0ba35b331932cd1931cd1467

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-request-id: c21699fb0fe7464b713401c46959b768
cache-control: max-age=3600
content-encoding: gzip
cf-cache-status: DYNAMIC
etag: W/"675b8628-272e1"
x-content-type-options: nosniff
cf-ray: 8f491582fbb37100-HEL
expires: Thu, 19 Dec 2024 18:24:04 GMT
date: Thu, 19 Dec 2024 17:24:04 GMT
content-type: application/javascript
last-modified: Fri, 13 Dec 2024 00:56:08 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 mercurio.html
tm.uol.com.br/ Frame C634 0
0 1084ms
392ms Document
text/html 13.32.99.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tm.uol.com.br/mercurio.html
Requested by: Host: tm.jsuol.com.br
URL: https://tm.jsuol.com.br/uoltm.js?id=ouy6ez
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-79.fra60.r.cloudfront.net
Software: marrakesh 1.23.0 /
Resource Hash

Request headers

Referer: https://114.235.205.92.host.secureserver.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

cache-control: no-transform, max-age=600, must-revalidate, proxy-revalidate must-revalidate, proxy-revalidate, no-transform
content-encoding: gzip
content-length: 173
content-type: text/html;charset=UTF-8
date: Thu, 19 Dec 2024 17:24:05 GMT
etag: ba5203ce522cc70a434e9a70452ca145
expires: Thu, 19 Dec 2024 17:34:05 GMT
last-modified: Sat, 09 Nov 2024 20:08:26 GMT
p3p: CP="NOI DSP COR NID TAIa OUR IND COM NAV INT CNT"
server: marrakesh 1.23.0
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
x-amz-cf-id: aNueGVTOy3S_DtXvCADXq_aeVmbUzBv6aim0CF72wlWZAjLT-6kB6Q==
x-amz-cf-pop: FRA60-P3
x-cache: RefreshHit from cloudfront

GET
H2 200 platcorpseguranca.js Show response
me.jsuol.com.br/aud/ 18 KB
8 KB 1151ms
461ms Script
application/javascript 52.222.214.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://me.jsuol.com.br/aud/platcorpseguranca.js
Requested by: Host: tm.jsuol.com.br
URL: https://tm.jsuol.com.br/uoltm.js?id=ouy6ez
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-58.fra56.r.cloudfront.net
Software: marrakesh 1.23.0 /
Resource Hash: 2938977098fcd9150adbfd5a2dc30254578d9b88ba24507ecbd22250aabdef1d

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-transform, max-age=3600, must-revalidate, proxy-revalidate, must-revalidate, proxy-revalidate, no-transform
content-encoding: gzip
etag: 8a9ebc3ef44359f62434a9e364e95e3e
via: 1.1 51bcd21e941ceaec99864557d86202ae.cloudfront.net (CloudFront)
expires: Thu, 19 Dec 2024 18:24:05 GMT
x-cache: Miss from cloudfront
content-length: 7366
x-amz-cf-id: eQjjt0rgSs_MPuMXoQ_lfSCLU_XBCQqo5Ooc-F_9RZ8HN7_uZlVDcQ==
date: Thu, 19 Dec 2024 17:24:05 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Fri, 06 Sep 2024 14:08:40 GMT
server: marrakesh 1.23.0
x-amz-cf-pop: FRA56-P3
vary: Accept-Encoding

GET
H2 200 dmp-uol-sync.js Show response
tm.jsuol.com.br/modules/ 12 KB
4 KB 333ms
333ms Script
application/javascript 18.172.112.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tm.jsuol.com.br/modules/dmp-uol-sync.js
Requested by: Host: tm.jsuol.com.br
URL: https://tm.jsuol.com.br/uoltm.js?id=ouy6ez
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.172.112.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-172-112-71.fra60.r.cloudfront.net
Software: marrakesh 1.23.0 /
Resource Hash: edaa42f9820d2eeac89b651363ec6695cb3c7bfed262fc3b181358eb72742cec

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-transform, max-age=3600, must-revalidate, proxy-revalidate, must-revalidate, proxy-revalidate, no-transform
content-encoding: gzip
etag: 54fe422dee18dcda521ff75d9521c606
via: 1.1 67697a0060e2336f6ffa8579d528820e.cloudfront.net (CloudFront)
expires: Thu, 19 Dec 2024 18:24:04 GMT
x-cache: Miss from cloudfront
content-length: 3901
x-amz-cf-id: 18K3nAXA3_sS1EoKEmOBaBZL_eGqA3ZLT6G1QVVXpuO01q7nrS0QnQ==
date: Thu, 19 Dec 2024 17:24:04 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 20 Nov 2024 22:40:57 GMT
server: marrakesh 1.23.0
x-amz-cf-pop: FRA60-P8
vary: Accept-Encoding

GET
H2 200 bhr.js Show response
dna-checker.pagseguro.uol.com.br/ 29 B
251 B 364ms
346ms Script
application/javascript 104.18.37.248
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dna-checker.pagseguro.uol.com.br/bhr.js?v=0.1.89

Requested by

Host:
URL: dna.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.248 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e787af995b842a676901ade5af3d5b2ef18a1e6b0dd4000dfc50bd0adcc3f6d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
cf-cache-status: DYNAMIC
etag: W/"1d-193d0738178"
x-content-type-options: nosniff
cf-ray: 8f4915891ae84e0f-HEL
x-response-time: 0.407ms
accept-ranges: bytes
content-length: 29
date: Thu, 19 Dec 2024 17:24:04 GMT
last-modified: Mon, 16 Dec 2024 17:10:51 GMT
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET
H2 200 / Show response
udr.uol.com.br/ 142 B
637 B 1466ms
485ms Fetch
application/json 13.35.58.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://udr.uol.com.br/
Requested by: Host: tm.jsuol.com.br
URL: https://tm.jsuol.com.br/modules/dmp-uol-sync.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-117.fra60.r.cloudfront.net
Software: awselb/2.0 /
Resource Hash: 2bc2f19845e040d8ac6f351284210fe3d93d114fd24a4e1df3d6abdca14ca194

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST
via: 1.1 43244f77affffa1d8942dd025413b8d8.cloudfront.net (CloudFront)
access-control-allow-origin: https://114.235.205.92.host.secureserver.net
x-cache: Miss from cloudfront
content-length: 142
x-amz-cf-id: 5siOdRvR8vZBnibwmTOARSu41E35Naut3GCtAFyn8OiBUGulTBNs9Q==
date: Thu, 19 Dec 2024 17:24:05 GMT
content-type: application/json
vary: Origin,Referer,cache-max-age
server: awselb/2.0
x-amz-cf-pop: FRA60-P10

GET
H2 200 / Show response
udr.uol.com.br/ 142 B
638 B 1465ms
484ms Fetch
application/json 13.35.58.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://udr.uol.com.br/?tag=base,custom-audience
Requested by: Host: tm.jsuol.com.br
URL: https://tm.jsuol.com.br/modules/dmp-uol-sync.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-117.fra60.r.cloudfront.net
Software: awselb/2.0 /
Resource Hash: 185abca95326cabb4953a299de977e988d40d83558fad9c7a805331c0b4f7033

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST
via: 1.1 43244f77affffa1d8942dd025413b8d8.cloudfront.net (CloudFront)
access-control-allow-origin: https://114.235.205.92.host.secureserver.net
x-cache: Miss from cloudfront
content-length: 142
x-amz-cf-id: Gsja7zt_Ahx5H3cNEgV349aOwhlvaB_cpzBoMSp0-NEoDlhKfTNg-g==
date: Thu, 19 Dec 2024 17:24:05 GMT
content-type: application/json
vary: Origin,Referer,cache-max-age
server: awselb/2.0
x-amz-cf-pop: FRA60-P10

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 267 KB
95 KB 766ms
179ms Script
application/javascript 142.250.186.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VPCVHFY8FT

Requested by

Host: me.jsuol.com.br
URL: https://me.jsuol.com.br/aud/platcorpseguranca.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

3a44a19f12b4f89fd2a8729786632fcf21331a52c1c9cf8c3fbd3eeb8997bed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 19 Dec 2024 17:24:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Dec 2024 17:24:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96424
x-xss-protection: 0
server: Google Tag Manager

GET
H2

200

beacon-ios.js Show response
sb.scorecardresearch.com/internal-cs/6036356/
Redirect Chain

https://sb.scorecardresearch.com/cs/6036356/beacon.js
https://sb.scorecardresearch.com/internal-cs/6036356/beacon-ios.js

18 KB
7 KB

212ms
212ms

Script
text/javascript

18.244.18.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-cs/6036356/beacon-ios.js
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: H2
Server: 18.244.18.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-18-32.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 093221956aa2c00be35ea7da4b587ddcf6b315138f35bdd73e3415c6a8ec3d41

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

vary: accept-encoding
cache-control: max-age=86400
content-encoding: gzip
etag: W/"e69bedd6f4196596076137491a2f8f21"
age: 1598
via: 1.1 11c65b00bf7f76c861a15dcad5558b9c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: aim5_4bD-R4JeSf7cVrE76SaEyPPMn1gQ_3utHF7W5RpufM0oQSNjg==
date: Thu, 19 Dec 2024 16:57:30 GMT
content-type: text/javascript
last-modified: Mon, 16 Dec 2024 11:25:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P11
x-amz-server-side-encryption: AES256

Redirect headers

location: /internal-cs/6036356/beacon-ios.js
accept-ch: UA, Platform, Arch, Model, Mobile
via: 1.1 11c65b00bf7f76c861a15dcad5558b9c.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: pkOPvwmytpWNMMtHolbRg63I75OQNbJBKorOt1L87wQx7MMjnauPJg==
date: Thu, 19 Dec 2024 17:24:05 GMT
x-amz-cf-pop: FRA56-P11

GET
H2 200 getuidj Show response
ib.adnxs.com/ 11 B
587 B 387ms
179ms Fetch
application/json 185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/getuidj

Requested by

Host: tm.jsuol.com.br
URL: https://tm.jsuol.com.br/modules/dmp-uol-sync.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 212.90.89.209; 212.90.89.209; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://114.235.205.92.host.secureserver.net
an-x-request-uuid: 917aa420-cdd4-421c-9b84-c794dc5be4c6
content-length: 11
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 19 Dec 2024 17:24:06 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2

200

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
m.t.tailtarget.com/sync/TT-10162-1/
Redirect Chain

https://m.t.tailtarget.com/sync/TT-10162-1/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
https://m.t.tailtarget.com/sync/TT-10162-1/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?check=1

43 B
129 B

230ms
230ms

Image
image/gif

34.102.185.99
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.t.tailtarget.com/sync/TT-10162-1/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?check=1
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: H2
Server: 34.102.185.99 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 99.185.102.34.bc.googleusercontent.com
Software: nginx/1.17.8 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: private, proxy-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 19 Dec 2024 17:24:06 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.17.8

Redirect headers

cache-control: private, proxy-revalidate
location: https://m.t.tailtarget.com/sync/TT-10162-1/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855?check=1
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 145
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 19 Dec 2024 17:24:06 GMT
content-type: text/html
server: nginx/1.17.8

GET
H2 204 b
sb.scorecardresearch.com/ 0
225 B 120ms
120ms Image
text/plain 18.244.18.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=6036356&cs_fpcu=07779d95b6f149de97c5c384fc52638b&cs_it=m1&cv=4.12.0%2B2412121612&ns__t=1734629046205&ns_c=UTF-8&cs_cfg=1111110&c7=https%3A%2F%2F114.235.205.92.host.secureserver.net%2FProdutosMensais%2Facesso%2F&c8=E-mail%20UOL&c9=
Requested by: Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.18.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-18-32.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

via: 1.1 11c65b00bf7f76c861a15dcad5558b9c.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-cf-id: h_OSd89wgcYyRx_-X10wpg8Rvj12xJEJ8h2FWy_MC0-PBYixA513_w==
date: Thu, 19 Dec 2024 17:24:06 GMT
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA56-P11

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 634ms
102ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-VPCVHFY8FT&gtm=45je4cc1v897314440za200&_p=1734629045449&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=283747994.1734629046&ul=fi-fi&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1734629046&sct=1&seg=0&dl=https%3A%2F%2F114.235.205.92.host.secureserver.net%2FProdutosMensais%2Facesso%2F&dt=E-mail%20UOL&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.uol_property_id=343114192&up.pseudo_id=none&up.cookie_consent=none&up.login_widget=deslogado&tfd=5568
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VPCVHFY8FT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://114.235.205.92.host.secureserver.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Dec 2024 17:24:06 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
559 B 718ms
118ms Ping
text/plain 142.251.173.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-VPCVHFY8FT&cid=283747994.1734629046&gtm=45je4cc1v897314440za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VPCVHFY8FT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.173.155 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: wi-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://114.235.205.92.host.secureserver.net
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Dec 2024 17:24:06 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.fi/ads/ 42 B
408 B 751ms
192ms Image
image/gif 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.fi/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-VPCVHFY8FT&cid=283747994.1734629046&gtm=45je4cc1v897314440za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=67518451

Requested by

Host: 114.235.205.92.host.secureserver.net
URL: https://114.235.205.92.host.secureserver.net/ProdutosMensais/acesso/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer: https://114.235.205.92.host.secureserver.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 19 Dec 2024 17:24:06 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET partner
tracker.bt.uol.com.br/ 0
0

GET purge-clients.html
tm.uol.com.br/ Frame CA50 0
0

GET purge-clients.html
tm.uol.com.br/ Frame 8FC2 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: jsuol.com.br
URL: https://jsuol.com.br/px/jquery.min.js

Domain: tracker.bt.uol.com.br
URL: https://tracker.bt.uol.com.br/partner?source=tagmanager

Domain: tm.uol.com.br
URL: https://tm.uol.com.br/purge-clients.html?name=DEretargeting&expname=DEretargetingExp&expdomain=1

Domain: tm.uol.com.br
URL: https://tm.uol.com.br/purge-clients.html?name=dynad_rt&expname=dynad_rt_exp&expdomain=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Universo Online (UOL) (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pagseguro.uol.com.br/	1970-01-21 01:50:30	Name: __cf_bm Value: XAab2yGAo3gbU3W53SQca9qUYtC5cnrYFy_utfPeARw-1734629044-1.0.1.1-ZkO5oktCYhpto46yDLswj8RPqt4jsuiTpmWmOD48NqXQoB0XkTcJ8hH2AcxOJwVhVofm90u4YwxhxVZjPRbU0g
.udr.uol.com.br/	1970-01-21 10:36:05	Name: UOLID Value: b50f15ed-1701-4423-88b7-570a443a080b\|0
.secureserver.net/	1970-01-21 11:12:05	Name: _scor_uid Value: 07779d95b6f149de97c5c384fc52638b
.secureserver.net/	1970-01-21 11:26:29	Name: _ga_VPCVHFY8FT Value: GS1.1.1734629046.1.0.1734629046.60.0.0
.secureserver.net/	1970-01-21 11:26:29	Name: _ga Value: GA1.1.283747994.1734629046
.t.tailtarget.com/	1970-01-21 10:36:05	Name: u Value: fwAAAWdkVrYuKga3HeecAgB=
.t.tailtarget.com/	1970-01-21 01:53:21	Name: _ssc Value: y

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://114.235.205.92.host.secureserver.net/ProdutosUol/acesso/index_files/main.59a0a285.chunk.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

114.235.205.92.host.secureserver.net
cdn-4.convertexperiments.com
dna-checker.pagseguro.uol.com.br
dna.uol.com.br
ib.adnxs.com
imguol.com
jsuol.com.br
m.t.tailtarget.com
me.jsuol.com.br
region1.analytics.google.com
sb.scorecardresearch.com
stats.g.doubleclick.net
tm.jsuol.com.br
tm.uol.com.br
tracker.bt.uol.com.br
udr.uol.com.br
www.google.fi
www.googletagmanager.com
jsuol.com.br
tm.uol.com.br
tracker.bt.uol.com.br
104.18.37.248
13.32.99.79
13.35.58.117
142.250.184.227
142.250.186.40
142.251.173.155
172.64.153.151
18.172.112.71
18.244.18.32
185.89.210.82
186.234.166.8
200.147.99.186
216.239.32.36
23.201.242.112
34.102.185.99
52.222.214.58
92.205.235.114
093221956aa2c00be35ea7da4b587ddcf6b315138f35bdd73e3415c6a8ec3d41
185abca95326cabb4953a299de977e988d40d83558fad9c7a805331c0b4f7033
2938977098fcd9150adbfd5a2dc30254578d9b88ba24507ecbd22250aabdef1d
2bc2f19845e040d8ac6f351284210fe3d93d114fd24a4e1df3d6abdca14ca194
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3a2c1203bb0b89977e59c0ec25bc379a0c8bad578ee295bea37f1d529234362e
3a44a19f12b4f89fd2a8729786632fcf21331a52c1c9cf8c3fbd3eeb8997bed2
5918ec0b37addadbc1c75720dcad660a82f95f4e21ed4e2593d56945f714100b
8215eb90b2ba2320f0374d7f10190377d5b1d5b65d3077b7fec0f1fa75200dc0
b75d97768deedde2829838149f82856789465d957771f78e54644a876626d262
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e787af995b842a676901ade5af3d5b2ef18a1e6b0dd4000dfc50bd0adcc3f6d4
ecbd019f0900cc8cdd11f7f7953ec3f4a6afc68d0ba35b331932cd1931cd1467
edaa42f9820d2eeac89b651363ec6695cb3c7bfed262fc3b181358eb72742cec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

114.235.205.92.host.secureserver.net Open in urlscan Pro 92.205.235.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

26 Requests

77 %HTTPS

0 %IPv6

12 Domains

18 Subdomains

18 IPs

4 Countries

267 kBTransfer

829 kBSize

7 Cookies

0 Outgoing links

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

7 Cookies

1 Console Messages

Indicators

114.235.205.92.host.secureserver.net Open in urlscan Pro
92.205.235.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

77 %
HTTPS

0 %
IPv6

12
Domains

18
Subdomains

18
IPs

4
Countries

267 kB
Transfer

829 kB
Size

7
Cookies

26 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!